Data Processing Agreement

This Personal Data Processing Agreement (the "Data Processing Agreement") is entered into between the business that subscribes to Cooku (the "Controller") and Cooku, a trade name operated by Victor Leonardo Garza Martínez, an individual acting as a sole proprietor, with an address for notices at Ciudad de México, C.P. 03400, México ("Cooku" or the "Processor"). It forms part of the Terms and conditions for businesses (https://usecooku.com/mx-en/terminos) and is accepted together with them.

Cooku is not yet incorporated as a company. If a company is formed in the future to operate it, that company will assume all the rights and obligations described in this document, including the role of controller of personal data. We will inform you in advance by email or within the platform, and you will not need to give your consent again for the same purposes.

Its purpose is to govern the processing that Cooku carries out, on behalf of the Controller, of the personal data of its customers and other persons related to its operations, in accordance with the Federal Law on Protection of Personal Data Held by Private Parties published in the Official Gazette of the Federation on March 20, 2025, and the provisions derived from it.

• Purpose: to provide the Controller with the Cooku services: orders, digital menu, reservations, events and tickets, payments, electronic invoicing, loyalty programs, promotions, campaigns and messages to its customers.
• Data subjects: the Controller's customers and diners, attendees of its events, recipients of its invoices, its suppliers and the members of its team.
• Data: identification and contact data (name, phone, email), delivery address and location, order, visit and spending history, tax data for invoicing, preferences, birthday (day and month), advertising consents and, when the Controller or the data subject records them, allergies and dietary restrictions, which may constitute sensitive data.
• Operations: collecting, storing, consulting, organizing, transmitting to the necessary providers, displaying to the Controller and erasing.
• Duration: for as long as the Terms remain in effect and until the data is returned or erased in accordance with this Data Processing Agreement.

Cooku will process the data only in accordance with the Controller's instructions. The Terms, this Data Processing Agreement and the settings the Controller configures in its dashboard (for example, enabling campaigns, WhatsApp messages or integrations) constitute documented instructions. Cooku will not use the data for its own purposes other than providing and securing the service and improving it with aggregated and anonymized information.

If Cooku considers that an instruction infringes the law, it will inform the Controller and may refrain from carrying it out.

• Have its own privacy notice informing its customers of the processing, including the use of Cooku as processor and of any pixels or messages it enables.
• Obtain the consents required by law, in particular express consent for sensitive data (allergies) and for sending advertising.
• Ensure that the data it uploads is accurate and that it has the right to process it and share it with Cooku.
• Handle its customers' requests to exercise their rights, with the support from Cooku described below.

Cooku ensures that the persons authorized to process the data are bound by confidentiality obligations, and applies reasonable administrative, technical and physical security measures appropriate to the nature of the data, including: encrypted connections, passwords stored with one-way hashing algorithms, encryption at rest of integration credentials, logical separation of each business's information, role-based access control and audit logs of access by the Cooku team.

The Controller grants Cooku a general authorization to engage the sub-processors it needs to provide the service. The current list is published at https://usecooku.com/mx-en/seguridad.

• Cooku will impose on each sub-processor data protection obligations equivalent to those of this Data Processing Agreement and will remain liable to the Controller for their compliance as provided by law.
• Cooku will give notice of relevant changes to sub-processors by updating that page and, where the change affects the Controller's customer data, by email at least 15 days in advance.
• If the Controller objects to a new sub-processor on reasonable data protection grounds, the parties will seek an alternative; if none exists, the Controller may terminate the Terms without penalty.
• Third-party services that the Controller decides to connect on its own (for example, its own payment processor, delivery platforms or its WhatsApp Business account) are governed by the direct relationship between the Controller and that third party.

The Controller acknowledges and accepts that some sub-processors process data outside its country, mainly in the United States. Cooku will choose sub-processors whose contractual terms offer a level of protection equivalent to that required by applicable law.

If a data subject sends Cooku a request for access, rectification, cancellation, objection or any other right concerning data processed on behalf of the Controller, Cooku will forward it to the Controller within 5 business days at most and will not resolve it on its own, unless instructed by the Controller. Cooku will make available to the Controller the dashboard tools and reasonable assistance to handle it, including deleting a customer's data.

If Cooku confirms a security breach affecting the Controller's data, it will notify the Controller without undue delay and, in any event, within 72 hours of confirmation, with the available information on its nature, the data affected, the measures taken and recommendations for data subjects. Cooku will cooperate so that the Controller can meet its own obligations to notify data subjects and the authority.

Upon termination of the Terms, the Controller may request an export of its data for 30 days. After that period, Cooku will erase the personal data processed on its behalf within the following 90 days, except data it must keep under a legal obligation, which will remain blocked and used solely for that purpose. Backups will be overwritten according to their rotation cycle.

Upon reasonable request and no more than once a year, Cooku will make available to the Controller the information necessary to demonstrate compliance with this Data Processing Agreement, by means of questionnaires, documentation or a meeting. On-site reviews will only take place when required by a competent authority or after a confirmed security breach, with 30 days' prior notice, at the Controller's expense and subject to confidentiality obligations. Requests to hola@usecooku.com.

Each party is liable for its own breaches of data protection law. Cooku's liability arising from this Data Processing Agreement is subject to the limits in the "Limitation of liability" section of the Terms, except where the law does not permit such limitation. In the event of a conflict between the Terms and this Data Processing Agreement regarding personal data, this Data Processing Agreement prevails.

This English version is provided for convenience. In case of any discrepancy, the Spanish version published on this site for your country prevails.